<Tag: htb-ctf />

Cadence in the Cord is a Sigrok/UART challenge where the apparent serial message only serves as a guide to a second, covert channel encoded in the inter-frame timing—short gaps as 0, long gaps as 1.

Line Tap demonstrates how a forgotten Telnet maintenance interface on an ICS host can be turned into instant, unauthenticated root via CVE-2026-24061 by abusing the NEW-ENVIRON USER=-f root trick, making the challenge a clean lesson in legacy service risk, argument injection, and critical exposure in operational technology environments.

Heavy Is The Krown is a hard Linux kernel exploitation challenge from HTB Cyber Apocalypse 2026 that revolves around a kmalloc-512 Use-After-Free in a custom `/dev/krown` driver, letting an attacker hijack slab objects shared by “lord” and “vassal” structures. By overlaying a freed vassal with procfs `seq_file` data to defeat KASLR and then abusing the dangling pointer to overwrite `modprobe_path`, the exploit script gains root execution via a crafted helper script and extracts the flag.

The Emptiness Machine is a modern FSOP-based pwn challenge from Hack The Box’s Cyber Apocalypse 2026 that demonstrates how glibc file stream structures in a fully mitigated Linux x86_64 environment can still be abused for powerful exploitation. By combining a controlled leak from stdout to defeat ASLR with a carefully aligned House of Apple 2 attack on stderr, the solver script reliably turns program teardown (_IO_flush_all()) into a remote shell and captures the flag.

The Hinge Whisper ultimately illustrates how a single, well-placed information leak paired with an executable, unprotected stack can unravel modern mitigations, turning a lore-flavored hatch service into a clean, textbook shellcode entry point. By leaking the exact stack buffer address, carefully shaping a compact execve payload that respects stack dynamics, and overwriting the function’s return address to pivot execution into our own bytes, we transform Rin’s quiet investigation of Maelor’s sealed strongbox into a full compromise that opens both the hatch and the path to the hidden flag.